Hot answers tagged

11

Http/2 requirements as per https://http2.github.io/http2-spec/#rfc.section.9.2.2 : 9.2.2 TLS 1.2 Cipher Suites A deployment of HTTP/2 over TLS 1.2 SHOULD NOT use any of the cipher suites that are listed in the cipher suite black list (Appendix A). Endpoints MAY choose to generate a connection error (Section 5.4.1) of type INADEQUATE_SECURITY if ...


5

In this example, StartSSL is your certificate provider. While logged into StartSSL, use the "Certificate Wizard" to submit your certificate signing request (CSR). You must have already validated your domain with them, which is to say, you went through the Validations Wizard and they've established that you have sufficient ownership of a domain to be ...


5

Set up a 2nd server (such as a virtual machine, or a 2nd daemon on the same host). Use a rewrite rule to reverse proxy requests for something optional to the 2nd server, like an invisible image hidden on the page. Configure the 2nd server to only allow TLS 1.2; don't hotlink to another hostname... make sure to proxy, or it won't be secure so maybe the ...


4

It looks like this is what you are after: https://github.com/Microsoft/Virtualization-Documentation/tree/master/windows-container-samples/windowsservercore/iis Sample to create a Windows Server Container Image with IIS 10.0 enabled These samples were created for Windows Server 2016 Technical Preview 3 with Containers. They assume that the ...


4

There being a CNAME record rather than a direct address record (A/AAAA) is not a factor. The certificate verification is based on the hostname in the location URL. For navigating to https://example.com/ to work, you would need a certificate that is valid for example.com. Ie, a certificate that either has example.com as the Subject CN (Common Name) or that ...


3

Two-parter: Yes. First step is identity of the receiving process, so you'll need to use a common identity for the service on both (which functionally means a domain user account, or better, a GMSA.) That'll let you interchangeably connect to either server by name (assuming an SPN is registered for each) but you did mention agnosticism towards which server ...


3

Since you don't intend to use this website externally, and you have a domain, you therefore have an internal certificate authority (CA). You should be able to create a signing request to send to your internal CA that will give you what you need for SSL.


3

I'm extremely skeptical about these results. While IIS may be faster, both posts do not mention anything specific about the hardware, OS settings(filesystem mount options, io schedulers, network buffers, tcp stakck setting and so on), web server config. Modern http servers are extremely complex animals, you can turn on and off huge amount of options, modules....


3

Yes it's possible to do this. The technology you are looking for is called Name Based Virtual Hosting.


3

SSL certificates from Amazon Certificate Manager can only be used with CloudFront and Elastic Load Balancers. It cannot be installed directly on an EC2 instance. If your app needs an SSL certificate installed, you will need to get it from another service.


3

Orignally, only one SSL certificate can be assigned to the same IP/Port combination. This is because host header is encrypted and HTTP layer cannot guess which host is requested and which certificate should be presented to client. If so, is there a workaround to make IIS think he can carry two SSL certificates? No, there are no workarounds in Windows ...


3

It's not a role service. It's a role. You will find it by going to Manage > Add Roles and Features:


3

One disadvantage is that your private key may now be on two machines. A client key should be private, by definition. If it's shared, then it's not private. That instantly reduces the trust anyone can have in your certificate. All other users of that server (if there are any) cannot now trust it, as its private key is known to be shared. Your question ...


3

About the only thing I can think of is having a proxy in front of the site that still supports the old standards, and have that redirect the user to a different site if it detects SSL2 or 3 connections (or an unsupported browser string?) Of course, to do this, you'll need a proxy that can talk the old protocols to older browsers securely without potentially ...


3

SSL handshaking occurs before any application-level communication, so if you want to prohibit 2/3 then browsers are going to get a very ugly message. On the other hand, you can enable 2/3 and have your application detect the low version and return the user a specific error message. Unfortunately at this point they've already sent you whatever session ...


3

You either: Connect to the the fully qualified hostname used in the certificate Don't use HTTPS for connections to localhost Generate a self-signed certificate that is valid for localhost


3

If I understand your question correctly, you want to do the following: application-1.my-server.company.com point to my-server.cloudapp.azure.com:8080 application-2.my-server.company.com point to my-server.cloudapp.azure.com:8081 application-3.my-server.company.com point to my-server.cloudapp.azure.com:8082 One solution is the use a reverse proxy. See ...


3

Yes, you can do. You can run any child domain (sub-domain ) on a different server using different web server application (Apache,IIS etc). All you can do is create a sub-domain (A record) in your registrar provided control panel for your main domain and point to the IP where your sub-domain web-server is running. Also make sure that your ServerAlias (in ...


3

Please check if you added the application "wscriativo" (the name you provided in the URL) to some application pool. I had the same problem and this was my problem. Probably you just created the wwwroot and this folder has other broken applications inside it. Add one application for each subfolder you want to run. This way you avoid using the broken ...


3

Not really. Seriously. I never had proper programmed code have a stackoverflow exception. Instead of throwing hardware, start debugging. You likely have some rarely used code path that throws a stackoverflow exception because of a programming bug under certain circumstances. Regardless how much memory you have. A debugger and 5 minutes work will at least ...


3

What you are looking for is appcmd.exe. It allows you to manage everything in IIS, including backing up and restoring the configuration. There are also many PowerShell cmdlets for managing IIS; these also includes ones for backing up and restoring the configuration.


3

On the taskbar, click Start, and then click Control Panel. In Control Panel, click Programs and Features, and then click Turn Windows Features on or off. Expand Internet Information Services, then World Wide Web Services, then Common Http Features. Select HTTP Redirection, and then click OK.


3

Before you start running network scanners on your network, have you actually asked your coworkers for any documentation, wikis, email chains, etc that might give you a better clue? Assuming no one knows anything and you're on your own. The first thing I'd do is a reverse DNS lookup on the IP that the URL maps to. If the public URL is a friendly name and ...


2

Worth noting that IIS 10.0 does support wildcard host names, see: http://www.iis.net/learn/get-started/whats-new-in-iis-10/wildcard-host-header-support


2

Yes! (As long as you're using IIS 7.0+) You need to set the loadUserProfile setting for the Application Pool Identity to true. The Application Pool Identity will now have a user profile under \Users\[Application Pool Name]. You can then edit this profile to have custom environment variables, etc. IIS 7 Tip # 3 You can now load the user profile of the ...


2

You need enough data ports so that client IP - client random port - server data port combination uniquely identifies any FTP session (transfer). So in 10-users scenario, single data port is likely more than enough. You just need to make sure that no one steals the single port away from your FTP server, before it actually starts using it. As the server ...


2

This solution was covered by Scott Hanselman in his blog (source at the bottom of the answer). Basically, HSTS is just an HTTP header. But you only want to send it when you are not in HTTPS. This will then lock your site in HTTPS for the max-age specified. Here's what should be in the web.config of your application: <?xml version="1.0" encoding="UTF-8"...


2

I've managed to confirm your observations (and mine) by looking into the code of ModSecurity IIS module, on GitHub. I found that the code inside CMyHttpModule::OnSendResponse, CMyHttpModule::OnPostEndRequest and CMyHttpModule::OnBeginRequest is wrapped inside EnterCriticalSection(&m_csLock); ... LeaveCriticalSection(&m_csLock); That, coupled ...


2

Found a solution in the end - I was forcing the nginx server to attempt serving files locally using the try_files $uri $uri/ =404;. All I had to do was remove this line and it works perfectly :) location / { proxy_pass http://104.46.52.226/; }


2

Right click on the "dev.domain.com" website, and "Add Virtual Directory". Call it 'mobile', set the physical path to be the mobile site's folder.



Only top voted, non community-wiki answers of a minimum length are eligible